<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-us" xml:lang="en-us">
 <head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="DC.Type" content="topic">
  <meta name="DC.Title" content="Creating a Ransomware Protection and WORM Policy">
  <meta name="product" content="">
  <meta name="DC.Relation" scheme="URI" content="ransome_0011.html">
  <meta name="prodname" content="">
  <meta name="version" content="">
  <meta name="brand" content="30-OceanProtect Appliance 1.5.0-1.6.0 Help Center">
  <meta name="DC.Publisher" content="20241029">
  <meta name="prodname" content="csbs">
  <meta name="documenttype" content="usermanual">
  <meta name="DC.Format" content="XHTML">
  <meta name="DC.Identifier" content="ransome_0012">
  <meta name="DC.Language" content="en-us">
  <link rel="stylesheet" type="text/css" href="public_sys-resources/commonltr.css">
  <title>Creating a Ransomware Protection and WORM Policy</title>
 </head>
 <body style="clear:both; padding-left:10px; padding-top:5px; padding-right:5px; padding-bottom:5px">
  <a name="ransome_0012"></a><a name="ransome_0012"></a>
  <h1 class="topictitle1">Creating a Ransomware Protection and WORM Policy</h1>
  <div>
   <p>This section describes how to set a ransomware protection and WORM policy for backup and replication copies.</p>
   <div class="section">
    <h4 class="sectiontitle">Precautions</h4>
    <p>If small file aggregation is enabled for a resource, ransomware protection policies cannot be created for the resource.</p>
   </div>
   <div class="section">
    <h4 class="sectiontitle">Procedure</h4>
    <ol>
     <li><span>Choose <strong id="ransome_0012__en-us_topic_0000001839142377_b1889510343412">Data Security</strong> &gt; <strong id="ransome_0012__en-us_topic_0000001839142377_b5895134144116">Ransomware Protection</strong> &gt; <strong id="ransome_0012__en-us_topic_0000001839142377_b7895183414418">Ransomware Protection and WORM Configurations</strong>.</span><p></p>
      <div class="note" id="ransome_0012__en-us_topic_0000001839142377_note811715311231">
       <img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span>
       <div class="notebody">
        <p id="ransome_0012__en-us_topic_0000001839142377_p201182362315">For 1.5.0, choose <strong id="ransome_0012__en-us_topic_0000001839142377_b93411301168">Explore</strong> &gt; <strong id="ransome_0012__en-us_topic_0000001839142377_b1889483131614">Data Utilization Policies</strong>.</p>
       </div>
      </div> <p></p></li>
     <li><span>Click <strong>Ransomware Protection and WORM Policies</strong>.</span></li>
     <li><span>Click <span class="uicontrol"><b><span><strong>Create</strong></span></b></span>.</span></li>
     <li><span>Enter basic information in the displayed dialog box. <a href="#ransome_0012__en-us_topic_0000001311216213_table37151336202216">Table 1</a> describes the basic parameters.</span><p></p>
      <div class="tablenoborder">
       <a name="ransome_0012__en-us_topic_0000001311216213_table37151336202216"></a><a name="en-us_topic_0000001311216213_table37151336202216"></a>
       <table cellpadding="4" cellspacing="0" summary="" id="ransome_0012__en-us_topic_0000001311216213_table37151336202216" frame="border" border="1" rules="all">
        <caption>
         <b>Table 1 </b>Basic parameters of a ransomware protection and WORM policy
        </caption>
        <colgroup>
         <col style="width:19.02%">
         <col style="width:80.97999999999999%">
        </colgroup>
        <thead align="left">
         <tr>
          <th align="left" class="cellrowborder" valign="top" width="19.02%" id="mcps1.3.3.2.4.2.1.2.3.1.1"><p>Parameter</p></th>
          <th align="left" class="cellrowborder" valign="top" width="80.97999999999999%" id="mcps1.3.3.2.4.2.1.2.3.1.2"><p>Description</p></th>
         </tr>
        </thead>
        <tbody>
         <tr>
          <td class="cellrowborder" valign="top" width="19.02%" headers="mcps1.3.3.2.4.2.1.2.3.1.1 "><p><span><strong>Name</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="80.97999999999999%" headers="mcps1.3.3.2.4.2.1.2.3.1.2 "><p>Ransomware protection and WORM policy name, which can be customized.</p>
           <div class="note">
            <span class="notetitle"> NOTE: </span>
            <div class="notebody">
             <p>The name of a ransomware protection &amp; WORM policy cannot be changed after creation.</p>
            </div>
           </div></td>
         </tr>
         <tr>
          <td class="cellrowborder" valign="top" width="19.02%" headers="mcps1.3.3.2.4.2.1.2.3.1.1 "><p><span><strong>Description</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="80.97999999999999%" headers="mcps1.3.3.2.4.2.1.2.3.1.2 "><p>Ransomware protection and WORM policy description. You are advised to enter description related to ransomware protection and WORM to facilitate subsequent management.</p></td>
         </tr>
        </tbody>
       </table>
      </div> <p></p></li>
     <li><span>Configure the ransomware protection and WORM policy. <a href="#ransome_0012__table537916590513">Table 2</a> describes the parameters.</span><p></p>
      <div class="tablenoborder">
       <a name="ransome_0012__table537916590513"></a><a name="table537916590513"></a>
       <table cellpadding="4" cellspacing="0" summary="" id="ransome_0012__table537916590513" frame="border" border="1" rules="all">
        <caption>
         <b>Table 2 </b>Ransomware protection and WORM policy parameters
        </caption>
        <colgroup>
         <col style="width:19.15%">
         <col style="width:80.85%">
        </colgroup>
        <thead align="left">
         <tr>
          <th align="left" class="cellrowborder" valign="top" width="19.15%" id="mcps1.3.3.2.5.2.1.2.3.1.1"><p>Parameter</p></th>
          <th align="left" class="cellrowborder" valign="top" width="80.85%" id="mcps1.3.3.2.5.2.1.2.3.1.2"><p>Description</p></th>
         </tr>
        </thead>
        <tbody>
         <tr>
          <td class="cellrowborder" valign="top" width="19.15%" headers="mcps1.3.3.2.5.2.1.2.3.1.1 "><p><strong>Ransomware Protection Policy</strong></p></td>
          <td class="cellrowborder" valign="top" width="80.85%" headers="mcps1.3.3.2.5.2.1.2.3.1.2 "><p>This option is disabled by default. After this option is enabled, you can set a scheduling plan for the ransomware protection policy to perform ransomware detection on backup and replication copies.</p></td>
         </tr>
         <tr>
          <td class="cellrowborder" valign="top" width="19.15%" headers="mcps1.3.3.2.5.2.1.2.3.1.1 "><p><span><strong>Schedule</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="80.85%" headers="mcps1.3.3.2.5.2.1.2.3.1.2 "><p>This parameter is displayed after <span class="uicontrol"><b>Ransomware Protection Policy</b></span> is enabled.</p> <p>Scheduling plan of the ransomware protection policy.</p>
           <ul>
            <li><strong><span><strong>Detect immediately after successful backup or replication</strong></span></strong></li>
            <li><strong><span><strong>Periodic Detection</strong></span></strong>
             <div class="p">
              Periodic detection parameters:
              <ul>
               <li><strong><span><strong>Detection Frequency</strong></span></strong>: every <em>xx</em> minutes, hours, days, or weeks</li>
               <li><strong><span><strong>Time of the First Detection</strong></span></strong>: start time of the first detection
                <div class="note">
                 <span class="notetitle"> NOTE: </span>
                 <div class="notebody">
                  <p>If the first detection time is set to an earlier time, detection starts in the next ransomware protection policy period after the setting is complete.</p>
                 </div>
                </div></li>
               <li><strong><span><strong>Detection Range</strong></span></strong>: You can perform detection for the latest copy, all copies, and copies generated after a specified time point.</li>
              </ul>
             </div></li>
           </ul></td>
         </tr>
         <tr>
          <td class="cellrowborder" valign="top" width="19.15%" headers="mcps1.3.3.2.5.2.1.2.3.1.1 "><p><span><strong>WORM Policy</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="80.85%" headers="mcps1.3.3.2.5.2.1.2.3.1.2 "><p>This option is disabled by default. After this option is enabled, you can set WORM for backup and replication copies.</p></td>
         </tr>
         <tr>
          <td class="cellrowborder" valign="top" width="19.15%" headers="mcps1.3.3.2.5.2.1.2.3.1.1 "><p><span><strong>WORM Setting</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="80.85%" headers="mcps1.3.3.2.5.2.1.2.3.1.2 "><p>This parameter is displayed after <span class="uicontrol"><b><span><strong>WORM Policy</strong></span></b></span> is enabled.</p> <p>When <strong>Ransomware Protection Policy</strong> is enabled, this parameter is used to set uninfected copies as WORM copies after ransomware detection is complete.</p> <p>When <strong>Ransomware Protection Policy</strong> is disabled, this parameter is used to set copies as WORM copies after backup or replication is successful.</p>
           <div class="note">
            <span class="notetitle"> NOTE: </span>
            <div class="notebody">
             <ul>
              <li>The expiration time of WORM copies will be delayed and the copies cannot be modified or deleted before they expire.</li>
              <li>For 1.5.0, WORM copies cannot be archived.</li>
             </ul>
            </div>
           </div></td>
         </tr>
        </tbody>
       </table>
      </div> <p></p></li>
     <li><span>Set resource object parameters. <a href="#ransome_0012__en-us_topic_0000001311216213_table1915523121510">Table 3</a> describes the parameters.</span><p></p>
      <div class="tablenoborder">
       <a name="ransome_0012__en-us_topic_0000001311216213_table1915523121510"></a><a name="en-us_topic_0000001311216213_table1915523121510"></a>
       <table cellpadding="4" cellspacing="0" summary="" id="ransome_0012__en-us_topic_0000001311216213_table1915523121510" frame="border" border="1" rules="all">
        <caption>
         <b>Table 3 </b>Resource object parameters
        </caption>
        <colgroup>
         <col style="width:25.919999999999998%">
         <col style="width:74.08%">
        </colgroup>
        <thead align="left">
         <tr>
          <th align="left" class="cellrowborder" valign="top" width="25.919999999999998%" id="mcps1.3.3.2.6.2.1.2.3.1.1"><p>Parameter</p></th>
          <th align="left" class="cellrowborder" valign="top" width="74.08%" id="mcps1.3.3.2.6.2.1.2.3.1.2"><p>Description</p></th>
         </tr>
        </thead>
        <tbody>
         <tr>
          <td class="cellrowborder" valign="top" width="25.919999999999998%" headers="mcps1.3.3.2.6.2.1.2.3.1.1 "><p><span><strong>Type</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="74.08%" headers="mcps1.3.3.2.6.2.1.2.3.1.2 "><p>Type of a resource object.</p>
           <ul>
            <li><strong><span><strong>Backup Copy</strong></span></strong>: Backup copies of the local cluster</li>
            <li><strong><span><strong>Replicated Copy</strong></span></strong>: Replication copies replicated from other clusters to the local cluster
             <div class="note">
              <span class="notetitle"> NOTE: </span>
              <div class="notebody">
               <p>Ensure that the local cluster functions as the secondary end of the remote replication pair and a replication copy has been generated.</p>
              </div>
             </div></li>
           </ul></td>
         </tr>
         <tr>
          <td class="cellrowborder" valign="top" width="25.919999999999998%" headers="mcps1.3.3.2.6.2.1.2.3.1.1 "><p><span><strong>Resource Type</strong></span></p></td>
          <td class="cellrowborder" valign="top" width="74.08%" headers="mcps1.3.3.2.6.2.1.2.3.1.2 "><p>Resource type. Ransomware detection applies only to <span class="uicontrol"><b>VMware VM</b></span>, <span class="uicontrol"><b><span><strong>NAS File Systems</strong></span></b></span>, <span class="uicontrol"><b><span><strong>NAS Shares</strong></span></b></span>, <span class="uicontrol"><b><span><strong>Filesets</strong></span></b></span>, <span class="uicontrol"><b>CNware VM</b></span>, <span class="uicontrol"><b>Huawei Cloud Stack</b></span>, <span class="uicontrol"><b>FusionCompute VM</b></span>, <span class="uicontrol"><b>OpenStack Cloud Server</b></span>, <span class="uicontrol"><b>Hyper-V VM</b></span>, and <span class="uicontrol"><b>FusionOne Compute VM</b></span>.</p>
           <div class="note">
            <span class="notetitle"> NOTE: </span>
            <div class="notebody">
             <p>For 1.5.0:</p>
             <ul>
              <li>Ransomware detection applies only to <span class="uicontrol"><b>VMware</b></span>, <span class="uicontrol"><b><span><strong>NAS File Systems</strong></span></b></span>, <span class="uicontrol"><b><span><strong>NAS Shares</strong></span></b></span>, and <span class="uicontrol"><b><span><strong>Filesets</strong></span></b></span>.</li>
              <li>WORM is supported for all resources except GaussDB (DWS).</li>
             </ul>
            </div>
           </div></td>
         </tr>
        </tbody>
       </table>
      </div> <p></p></li>
     <li><span>Select the resource on which detection is to be performed and click <span class="uicontrol"><b><span><strong>OK</strong></span></b></span>. The system performs detection on the copies of the selected resource according to the scheduling plan configured in the ransomware protection and WORM policy.</span><p></p>
      <div class="note">
       <img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span>
       <div class="notebody">
        <p>Dynamic detection is performed by default after a ransomware protection policy is configured. For details about how to switch to static detection, see <a href="ransome_0021.html">Managing the Detection Mode</a>.</p>
       </div>
      </div> <p></p></li>
    </ol>
   </div>
  </div>
  <div>
   <div class="familylinks">
    <div class="parentlink">
     <strong>Parent topic:</strong> <a href="ransome_0011.html">Configuring Ransomware Protection for Copies</a>
    </div>
   </div>
  </div>
 </body>
</html>